Umbrella VA - First Configuration

We have already seen how Umbrella works in previous posts and now let's do the basic configuration.

Configuration Mode on a VA Deployed:

When you open the VA in your preferred hypervisor's console, and you'll see a configuration menu. As seen in the lower right corner, the system time is set to UTC by default. This will not affect your DNS, network, or hypervisor.

To access the VA console efficiently, use a native application (such as VMware vSphere Client, VMware Remote Console, or RDP)

If you have deployed the VA in a network that supports DHCP, the VA is automatically assigned a DHCP IP address and registers to Umbrella using this IP. This IP address appears on the configuration as well as the Umbrella dashboard.

1- Press Ctrl+B and when prompted, provide a password for configuration changes;

Note: Umbrella<OrgID> should be set as the default password for the VA. Your Org ID can be retrieved from the dashboard URL in your address bar.

2- Optionally, enable remote configuration of this VA over SSH, enter config va ssh enable;

3- If you have enabled SSH, you can now remotely connect to the VA over SSH and enter Configuration Mode after authentication. use vmadmin as your login.

Note: Configuration mode does not support concurrent access by more than two users.

Configure the VA Through Configuration Mode:

Configure the name:

config va name <hostname>

Configure the IP, Netmask, and Gateway:

config va interface <ipaddress> <netmask> <gateway>

Configure an IPv6 address:

config va interface6 <ipv6 address>/<prefix> <ipv6-gateway>

Configure SNMP:

config snmp configure -v2 c <community>

Configure NTP:

config ntp add <ipaddress>

Configure local DNS:

config localdns add <ipaddress>

Configure Rate-limiting:

config va per-ip-rate-limit enable <pps> <burst>

Configure Umbrella Resolvers:

*By default, the VA is configured to use the standard Umbrella resolvers ( and

config va resolvers alternate

Configure DNSSEC Support:

config va dnssec enable

Logging to Remote Syslog Server:

config logexport destination <rsyslog-server-ip:port> <protocol>

Troubleshooting commands:

  • config snmp status

  • config ntp show

  • config localdns show

  • config va show

  • config va status

  • config logexport status

  • config anycast bgp status

  • config tunnel status

  • config anycast status


65 views0 comments

Recent Posts

See All

The Cisco Integrated Management Interface (CIMC) permits monitoring of the server inventory, health, and system event logs using the built-in Cisco Integrated Management Controller (CIMC) GUI or CLI i

Cisco ISE Upgrade Readiness Tool (URT) helps detect and fix any data upgrade issues before you start the upgrade process. Most of the upgrade failures occur because of data upgrade/corruption issues.

When you try to back up the ISE configuration, the backup process fails even though there is enough disk space available. Follow some steps to fix this issue: ise/admin# show backup status %% Configur